@hardikg/mdview 0.9.1 → 0.11.0

package/CHANGELOG.md

@@ -7,6 +7,88 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.11.0] — 2026-10-25
+
+A security release. Upgrade if you open markdown you did not write: a file in
+an open folder could read other files on your machine through an SVG and a
+symlink, and several crafted inputs could stall or exhaust the server. This
+release also needs Node 22.12, starts faster, ships 43% smaller, and restarts
+an older background server by itself, so the fixes take effect after
+`npm i -g`.
+
+### Security
+- **Security fixes now take effect after `npm i -g` without `mdview stop`.** `mdview <path>` replaces a background server that runs another version (or, like 0.10.0 and older, reports none) and prints `mdview: restarted the background server (old → new)`. Open folders stay open. `/api/health` now reports `version`.
+- **The registry answer is validated before it reaches your terminal.** The version must be plain semver, the read is capped at 64 KB and 5 s, redirects are refused, and errors never echo the response. A `.mdview.json` in a cloned repo cannot turn on the update check.
+- **KaTeX is updated to 0.19, which fixes a prototype-pollution advisory** that could bypass its `trust` restrictions. KaTeX ships inside the client bundle, so `npm audit --omit=dev` never reported it.
+- **A markdown file can no longer run script through an SVG beside it.** A document could frame `/__asset/…/evil.svg`, or link to it, and the SVG's script ran with no policy and could read other files and send them off the machine. Every `/__asset/*` response and every SVG response now carries a sandbox CSP, `nosniff` and `Cross-Origin-Resource-Policy: same-origin`, including when the route is reached through a percent-encoded URL. The page policy adds `frame-src 'none'` and `object-src 'none'`.
+- **Symlinks can no longer lead out of an open folder.** A link committed into a repo (`notes.md -> /etc/hosts`, `logo.png -> ~/.ssh/id_ed25519`) was served as if it lived in the folder. Paths are now checked again after resolving every link. Links that stay inside the folder still work.
+- **A regex folder search can no longer freeze the server.** A backtracking pattern could block every request for minutes. Regex search now runs in a worker thread that is stopped after 3 s, and the panel shows what it found so far. At most two searches run at once; the rest wait their turn.
+- **`.txt` and `.pdf` are no longer served as assets, and nothing under a dot-folder is.** Only image, video and audio types are served.
+- **The file watcher no longer follows symlinks**, so a repo holding `link -> /` no longer walks the whole disk.
+- **`~/.config/mdview` is now private to your user.** The folder is `0700` and its files `0600`, and existing ones are tightened. They list every folder you have opened.
+- **A link with `%22` in its path can no longer add attributes to the page.**
+- **Front matter is now also bounded by characters.** Aliases to one long string stayed under the 10,000-node limit but expanded to about 100 MB; over 1,000,000 characters is now treated as plain text.
+- **VS Code preview:** the webview now forwards only the extension's own messages into the preview.
+- **A page on another site can no longer frame the VS Code preview.** `--vscode` mode cannot use `frame-ancestors`, so any page could frame the server and talk to the preview. The extension now creates a random token for every launch and passes it in an environment variable, never on the command line. The server answers its page and API only to requests that carry it. The CLI refuses `--vscode` without the token and never prints it.
+- **A crafted markdown file can no longer stall the server while it renders.** An HTML block full of `<a ` or `<img ` with no closing `>` took 12 s at 480 KB and close to a minute at 1 MB, and blocked every other request; any open document could trigger it with an image pointing at `/api/file`. Links and images are now rewritten in one pass over the page: 1 MB takes about 25 ms.
+- **A website can no longer make folder search use a gigabyte of memory.** A search for `a` over a file holding one 15 MB line kept all 15 million matches and took the server past 1 GB. Plain searches now skip lines over 10,000 characters, only count matches past the 20 shown per file, and stop after 1 s. Opening or searching a large file no longer splits it into millions of lines at once, which cost about 500 MB for 15 MB of short lines.
+- **A markdown file can no longer send the tab to another site.** A `<meta http-equiv="refresh">` in a document's HTML navigated the whole tab, and a page's security policy cannot block that. `<meta>` and `<base>` tags are now removed from a document's HTML when it renders.
+- **Opening one file no longer exposes its whole folder.** `mdview ~/README.md` served every image under `$HOME` and watched `$HOME` recursively. A single file is now watched on its own, and only the images and media the document references are served.
+- **Dot-folders are also checked on the real path**, so an in-folder link into `.git` is refused by `/__asset/*`, and so is a Windows short name such as `GIT~1`.
+- **Every response now carries `X-Content-Type-Options: nosniff`**, not only HTML pages, and the `workspace.json` watcher no longer follows symlinks.
+- - **Shipped dependencies are updated to clear advisories:** `markdown-it` 14.3.2 → 15.0.3 (quadratic-time parsing of inline HTML when `html` is enabled, of a multi-line link reference definition, and further quadratic paths fixed in 15.0.1–15.0.3), `fastify` 5.12.5 → 5.12.7 (header validation bypass via case-sensitive `propertyNames`), and `fast-uri` 3.1.8 → 3.1.9 and 4.2.1 → 4.2.3 (scheme spoofing, path equivalence and host confusion in URI handling). The `markdown-it` ones were reachable: the renderer enables `html`, so a crafted markdown file could block the server. The others were not reachable as mdview is configured (no route declares a schema), but they ship in the install. `shiki` 4, `js-yaml` 5 and `open` 11 are also taken.
+- **Folder search can no longer stall the server or exhaust its memory through many parallel requests.** At most two searches run at once across the whole server, literal and regex alike; later ones wait, and one whose page goes away is dropped. File contents read for searches share one 32 MB budget, and literal matching gives way to other requests every 10 ms. Sixteen parallel searches fired from `<img>` tags used to stall every request for 13 s and take the server past 2 GB; other requests now answer within 0.1 s and memory stays under 0.6 GB.
+
+### Removed
+- **Node 20 is no longer supported; mdview now needs Node 22.12 or later.** Node 20 reached end of life on 2026-04-30, and a fresh install of 0.10.0 already failed to start a server on Node 20.0–20.18: `@fastify/static` 10.1.7 pulls `content-disposition` 3, which ships ES modules only, and Node loads those through `require()` without a flag only from 22.12. Run `node --version` before upgrading. The VS Code extension now needs VS Code 1.101 or later, the first release that runs on Node 22.
+
+### Added
+- **`mdview update` checks for a newer release and prints the install command.** It asks registry.npmjs.org once, sends nothing that identifies you, and never installs or runs npm. The command is pinned to that version and uses the npm beside the Node that runs mdview.
+- **An optional daily update notice, off by default.** `mdview config update-check on` makes the background server check about once a day. `mdview <path>` then prints one line to stderr, at most once a day per version, and only in a terminal. Only the global config can turn it on.
+- **`mdview ls` says when the background server runs a different version** than the CLI.
+
+### Changed
+- **`mdview --version`, `ls`, `rm` and `stop` start about five times faster.** They took about 0.2 s because every command loaded the web server, syntax highlighter and file watcher first; they now take about 0.04 s. The server code loads only when a command starts one.
+- **The first document opens faster** (about 250 ms → 80 ms for a page of code). The syntax highlighter warms up right after the server starts listening and loads only the default palette's themes up front. Other palettes load the first time you pick them.
+- **Live reload no longer re-highlights unchanged code blocks.** Highlighted blocks are cached (up to 8 MB, keys included, since a key holds the language name from the file), so saving a document with many large code blocks re-renders only what changed.
+- **Folder search is faster.** Files are read eight at a time and kept in a cache that the file watcher keeps current: a repeated search over 4,000 files drops from about 1 s to about 70 ms. A search stops when you change the query.
+- **The package is about 43% smaller (1.4 MB → 0.8 MB).** JetBrains Mono and KaTeX now ship as woff2 only, which every supported browser already used.
+- **Markdown files over 16 MB are no longer rendered or searched.** Rendering is synchronous, so one huge file stalled every other request.
+- **A single-file target that is itself a symlink is served from the folder its link points into.**
+- **`mdview <file>` shows only that file and the media it references.** An image in the same folder that the document does not reference is no longer served.
+- **Links and images written as raw HTML are now rewritten like markdown ones.** Single-quoted, unquoted or upper-case attributes, and a `>` inside a quoted value, no longer stop a relative `.md` link or image path from resolving. Links inside HTML comments are left alone.
+- **A search that skips a very long line says so** with "More results truncated".
+- **Front matter dates display as written** (`2024-01-02`) instead of as timestamps (`2024-01-02T00:00:00.000Z`). Front matter is now parsed as YAML 1.2 with merge keys (`<<: *defaults`) still applied.
+- **Diagrams render with pele 1.10.** Labels and links in diagrams are sanitised more strictly (entity codes decode once; stray non-characters are stripped before the link scheme check), subgraph diagrams have fewer edge crossings, class diagrams wrap into rows instead of shrinking, CJK labels wrap, and `List<T>` in a label no longer renders as `List`. A `%%` comment no longer deletes the character before it, so a diagram that only parsed because of that now shows a syntax error.
+
+### Fixed
+- **Two CLIs started at the same moment can no longer both spawn a background server.** Taking the spawn lock now re-checks for a server a rival just started.
+- **A front matter block holding only whitespace or comments is still recognised as front matter** and removed from the page.
+- **Navigating between files no longer drops and reopens the live-reload connection.** The watch stream reconnected on every navigation, so a file change could fall into the gap, and the server's connected-tab count briefly dropped to zero, which matters with `MDVIEW_IDLE_TIMEOUT`. One connection now lasts for the life of the page.
+- **A burst of file changes no longer refetches the file tree hundreds of times.** Switching git branches fired one full tree request per added or removed file. Refreshes now wait 150 ms after the last change and run once, and the tree still ends up current.
+- **A markdown file with millions of blank lines after its front matter renders again**, and folder search includes it. It used to overflow the stack and return a 500.
+- **`mdview README.MD` on a case-insensitive disk (macOS, Windows) now live-reloads** when `README.md` is saved.
+- **The VS Code preview keeps working after its frame or the webview reloads.** It used to stop following the editor.
+
+## [0.10.0] — 2026-10-19
+
+A security fix for front matter, and a lighter diagram renderer that follows
+your palette. Upgrade if you open markdown you did not write: in 0.9.1 and
+earlier, a file could run code on your machine.
+
+### Security
+- **Front matter is now parsed as YAML only.** Previously a file that began `---js` (or `---javascript`) had its front matter evaluated as JavaScript inside the server process when you opened it, so an untrusted `.md` file could run code on your machine. That path is gone.
+- **YAML aliases can no longer expand a small front matter block into a huge response.** A few hundred bytes of nested aliases could produce hundreds of MB of JSON, or a cycle, and take the server down. The parsed front matter is now bounded at 10,000 nodes; a block over that is treated as plain text.
+- **`gray-matter` is replaced by `js-yaml` 4.** This drops `js-yaml` 3, `argparse` 1 and `sprintf-js`, which `npm audit` flagged, so `npm audit --omit=dev` reports 0 vulnerabilities again.
+- **`img-src` no longer allows `blob:`.** Only the old diagram output needed it.
+
+### Changed
+- **Only a bare `---` line opens front matter.** A `---js`, `---json` or `---yaml` opening line is now body text. A front matter block that is a list or a single value is still removed from the page, but shows no metadata.
+- **Mermaid diagrams now render with pele instead of the mermaid library.** The lazy diagram code drops from about 899 kB to about 287 kB gzipped across all chunks, and a page loads only the diagram types it uses. Diagrams follow the active palette and light/dark through CSS variables, with no re-render on a switch. Diagrams look different, because pele has its own layout and visual style. A left-to-right flowchart too wide for the text column now switches to a top-down layout at full text size, where it used to shrink to fit.
+
+### Fixed
+- **External-link marking no longer breaks on SVG links.** An inline SVG anchor has read-only `target` and `rel` properties, so assigning them threw and stopped the marking of every later link. SVG anchors are now skipped.
+
 ## [0.9.1] — 2026-10-04
 
 A file tree that keeps deep paths readable, and a dependency refresh.

package/README.md

@@ -4,7 +4,7 @@
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 [![Node](https://img.shields.io/badge/node-%3E%3D20-brightgreen)](https://nodejs.org)
 
-A local markdown viewer for reading long, hierarchical docs without losing focus. Run a command, browser opens with a beautifully rendered, navigable view of your file or folder. Edits in your editor show up live. Close terminal to stop.
+A local markdown viewer for reading long, hierarchical docs without losing focus. Run a command, browser opens with a beautifully rendered, navigable view of your file or folder. Edits in your editor show up live. One background server hosts every folder you open; `mdview stop` ends it.
 
 ```
 mdview ./docs              # browse a folder
@@ -28,7 +28,7 @@ Reading long markdown docs is hard:
 npm install -g @hardikg/mdview
 ```
 
-Requires Node >= 20. The `mdview` binary lands on your `PATH`.
+Requires Node >= 22.12. The `mdview` binary lands on your `PATH`.
 
 ## Install from source
 
@@ -63,10 +63,12 @@ npm install -g ./hardikg-mdview-<version>.tgz
 
 ```bash
 mdview <path>              # open a file or folder; the shell comes straight back
+                           #   (a single file shows only that file and the media it references)
 mdview                     # current directory
 mdview ls                  # what's open, and where the server is
 mdview rm <name>           # stop serving a folder
 mdview stop                # stop the background server
+mdview update              # is there a newer release? prints the install command
 mdview --foreground        # run in this terminal instead (Ctrl-C to stop)
 mdview --no-open           # don't auto-launch the browser
 mdview --port 9000         # one-off server on a specific port (implies --foreground)
@@ -108,7 +110,12 @@ rather it stood down on its own, set `MDVIEW_IDLE_TIMEOUT` to a number of
 minutes and it will exit that long after the last browser tab disconnects; the
 next `mdview` starts it again.
 
-Its state lives in `~/.config/mdview/` (`daemon.json`, `workspace.json`,
+After you upgrade mdview, the next `mdview <path>` notices that the background
+server runs an older version, restarts it and prints one line
+(`mdview: restarted the background server (0.10.0 → 0.11.0)`). Your open folders
+stay open. `mdview ls` only reports the mismatch.
+
+Its state lives in `~/.config/mdview/` (`daemon.json`, `workspace.json`, `update-check.json`,
 `daemon.log`) and nowhere else. `workspace.json` is also how the CLI talks to
 the server: `mdview <path>` writes the file and the server picks the change up,
 which is why there is no HTTP endpoint that can change what's being served.
@@ -125,8 +132,9 @@ entirely.
 `kanagawa`, `catppuccin`, or `high-contrast`.
 It wins over both `.mdview.json` and the global config, and never writes to
 either. There is also a `--vscode` flag, used by the VS Code extension to run
-mdview as a sidecar; it implies `--no-open` and prints a single JSON ready line
-instead of the human-readable output.
+mdview as a sidecar; it implies `--no-open`, prints a single JSON ready line
+instead of the human-readable output, and needs the per-launch token the
+extension passes in `MDVIEW_EMBED_TOKEN`.
 
 `--port` and `--palette` both override a setting that belongs to a whole server,
 and the background one is shared with every other folder you have open — so each
@@ -154,7 +162,7 @@ unexpected errors.
 | `⇧H` / `⇧L` | Previous / next file in folder |
 | `Ctrl+D` / `Ctrl+U` | Half-page down / up |
 | `Alt` / `⌥` + scroll | Fast scroll (~4×) in the main pane |
-| `f` / `m` | Toggle focus mode / minimap |
+| `f` / `m` / `w` | Toggle focus mode / minimap / wide layout |
 | `e` / `⇧E` | Expand all / collapse all sections |
 | `Tab` (in search) | Cycle Doc ↔ Folder scope |
 | `Enter` / `Shift+Enter` | Next / previous match in search |
@@ -169,10 +177,10 @@ Click the keyboard icon in the header anytime to see the full list.
 - 3-pane layout: folder tree, content, outline. Both sidebars collapse to a thin label rail; both have drag handles to resize (widths persist).
 - Editorial typography (serif body, italic accent H1, paper-grain background, JetBrains Mono in code blocks).
 - Light & dark theme — follows your OS preference, with a manual override that persists.
-- Eight built-in palettes: flexoki / paper / solarized / everforest / rose-pine / kanagawa / catppuccin / high-contrast. Pick one from the header palette swatch. Each defines a full light and dark variant and its own ground texture: a dot grain on the paper-like palettes, fibre noise on Everforest and Kanagawa, an accent wash on Rosé Pine and Catppuccin, and none at all on high-contrast. Code blocks follow the palette (Everforest syntax in Everforest, Catppuccin in Catppuccin, etc.).
+- Eight built-in palettes: flexoki / paper / solarized / everforest / rose-pine / kanagawa / catppuccin / high-contrast. Pick one from the View menu (gear icon in the header). Each defines a full light and dark variant and its own ground texture: a dot grain on the paper-like palettes, fibre noise on Everforest and Kanagawa, an accent wash on Rosé Pine and Catppuccin, and none at all on high-contrast. Code blocks follow the palette (Everforest syntax in Everforest, Catppuccin in Catppuccin, etc.).
 - Reading-progress bar pinned to the bottom of the header.
 - Doc stats strip below the H1 (reading time, word count, heading count, "Updated N ago").
-- Focus mode dims everything except the section at the viewport center.
+- Focus mode dims everything except the section you are reading: the one whose heading last crossed the top-third of the viewport.
 - Optional minimap rail at the right edge: bars per heading, draggable to scroll, viewport indicator follows.
 
 **Navigation**
@@ -186,11 +194,11 @@ Click the keyboard icon in the header anytime to see the full list.
 **Rendering**
 - CommonMark + GFM (tables, task lists, strikethrough, autolinks).
 - Server-side syntax highlighting via Shiki, palette-aware: two variants per token, light and dark, for whichever palette is active. Zero client highlighter bundle, and the light/dark toggle repaints with no request.
-- Mermaid diagrams, lazy-loaded only when a doc contains a `mermaid` fence.
+- Mermaid diagrams, rendered with [pele](https://github.com/obsidianmd/pele) and lazy-loaded only when a doc contains a `mermaid` fence. Colours follow the active palette and light/dark.
 - Math via KaTeX (`$inline$` and `$$block$$`), lazy-loaded only when a doc contains math.
 - Custom-styled task list checkboxes (filled accent when checked, hollow when unchecked).
 - Front matter detected and shown as a small collapsible metadata block.
-- Inline HTML pass-through (your content, your trust).
+- Inline HTML pass-through (your content, your trust), except `<meta>` and `<base>`, which could send the tab to another site.
 - Images render via a safe `/__asset/*` route with relative-path resolution against the file's folder. Click any image to open in a lightbox.
 - External links get an `↗` icon and open in a new tab with `noopener noreferrer`.
 
@@ -225,6 +233,8 @@ Two layered files, both optional, same schema:
 }
 ```
 
+The global file also takes `"updateCheck": true` (see [Updates](#updates)). A per-project file ignores it.
+
 All fields optional. Validated on load — invalid values fall back silently with a warning. Edit the per-project file while the server is running and the SPA picks up palette/font/lineWidth changes live; `ignore` is read once at startup (the file watcher's skip list is frozen — restart mdview after editing).
 
 `ignore` extends the built-in skip list (which already covers `node_modules`, `dist`, `build`, `out`, `target`, `coverage`, `vendor`, `__pycache__`, `venv`, `Pods`, `DerivedData`, `_build`, plus every dotfile/dotdir). Add your own basenames here — handy when running mdview at a repo root with non-standard build dirs to avoid `EMFILE: too many open files` from the OS file-watch limit.
@@ -236,11 +246,43 @@ mdview config path                  # print the global config path
 mdview config ignore list           # show built-in + user-added entries
 mdview config ignore add deps _site # add one or more basenames
 mdview config ignore rm  deps       # remove one or more basenames
+mdview config update-check on       # daily check for a newer release (off by default)
+```
+
+## Updates
+
+`mdview update` asks `registry.npmjs.org` for the latest version. When it is
+newer than the one you run, it prints the install command. It does not run it.
+
 ```
+$ mdview update
+mdview 0.11.0 → 0.12.0 is available.
+Install it with:
+
+  /Users/you/.nvm/versions/node/v22.20.0/bin/npm install -g @hardikg/mdview@0.12.0
+
+The background server restarts itself on the next `mdview` run.
+```
+
+The command uses the `npm` that sits next to the Node running mdview, so the
+upgrade lands in the install you use. On Windows the line is written for `cmd`;
+in PowerShell, put `&` in front of a quoted path. The request carries nothing
+about you: no identifier, cookie or custom header.
+
+A daily notice is available and **off by default**:
+
+```bash
+mdview config update-check on     # `off` to disable, no argument to show
+```
+
+While it is on, the background server checks once a day. `mdview <path>` then
+prints one line to stderr, at most once a day per version, and only in a
+terminal: ``mdview 0.12.0 is available — run `mdview update` for the install command.``
+Only the global config can turn it on. A `.mdview.json` in a cloned repo cannot.
 
 ## Stack
 
-Node 20+, TypeScript, Fastify 5, markdown-it 14, Shiki 1, gray-matter, chokidar 4, Preact 10 + @preact/signals, KaTeX 0.16, mermaid 11 (lazy), JetBrains Mono via @fontsource, Vite 6, tsup 8, vitest 2.
+Node 22.12+, TypeScript 7, Fastify 5, markdown-it 15, Shiki 4, js-yaml 5, chokidar 4, Preact 11 + @preact/signals, KaTeX 0.19, pele (lazy), JetBrains Mono via @fontsource, Vite 8, tsup 9, vitest 5.
 
 ## Documentation
 

package/bin/chunk-RBYD2HWV.mjs

@@ -0,0 +1,196 @@
+#!/usr/bin/env node
+import {
+  DEFAULT_PALETTE
+} from "./chunk-XFRQFZZ4.mjs";
+
+// src/render/shiki.ts
+import { createHash } from "crypto";
+import { createHighlighter } from "shiki";
+
+// src/render/byte-lru.ts
+var ByteLru = class {
+  constructor(maxBytes) {
+    this.maxBytes = maxBytes;
+  }
+  maxBytes;
+  entries = /* @__PURE__ */ new Map();
+  totalBytes = 0;
+  hitCount = 0;
+  missCount = 0;
+  get(key) {
+    const entry = this.entries.get(key);
+    if (entry === void 0) {
+      this.missCount++;
+      return void 0;
+    }
+    this.hitCount++;
+    this.entries.delete(key);
+    this.entries.set(key, entry);
+    return entry.value;
+  }
+  set(key, value) {
+    const bytes = Buffer.byteLength(key, "utf8") + Buffer.byteLength(value, "utf8");
+    this.delete(key);
+    if (bytes > this.maxBytes) return;
+    this.entries.set(key, { value, bytes });
+    this.totalBytes += bytes;
+    for (const [oldest, entry] of this.entries) {
+      if (this.totalBytes <= this.maxBytes) break;
+      this.entries.delete(oldest);
+      this.totalBytes -= entry.bytes;
+    }
+  }
+  delete(key) {
+    const entry = this.entries.get(key);
+    if (entry === void 0) return;
+    this.entries.delete(key);
+    this.totalBytes -= entry.bytes;
+  }
+  stats() {
+    return {
+      entries: this.entries.size,
+      bytes: this.totalBytes,
+      hits: this.hitCount,
+      misses: this.missCount
+    };
+  }
+};
+
+// src/render/shiki.ts
+var COMMON_LANGUAGES = [
+  "ts",
+  "tsx",
+  "js",
+  "jsx",
+  "python",
+  "go",
+  "rust",
+  "java",
+  "kotlin",
+  "css",
+  "scss",
+  "html",
+  "json",
+  "yaml",
+  "toml",
+  "bash",
+  "shell",
+  "sql",
+  "md",
+  "diff",
+  "dockerfile"
+];
+var PALETTE_THEMES = {
+  // Flexoki has no upstream TextMate theme. `min-light` and `vesper` are the
+  // closest bundled stand-ins: both are deliberately low-chroma, which is the
+  // one property of Flexoki that a louder theme would contradict.
+  flexoki: { light: "min-light", dark: "vesper" },
+  paper: { light: "min-light", dark: "vitesse-dark" },
+  solarized: { light: "solarized-light", dark: "solarized-dark" },
+  everforest: { light: "everforest-light", dark: "everforest-dark" },
+  "rose-pine": { light: "rose-pine-dawn", dark: "rose-pine" },
+  kanagawa: { light: "kanagawa-lotus", dark: "kanagawa-wave" },
+  catppuccin: { light: "catppuccin-latte", dark: "catppuccin-mocha" },
+  "high-contrast": { light: "github-light-high-contrast", dark: "github-dark-high-contrast" }
+};
+var INITIAL_THEMES = Array.from(new Set(Object.values(PALETTE_THEMES[DEFAULT_PALETTE])));
+var WARM_SNIPPETS = [
+  ["ts", "import { a } from './a';\ninterface Row<T> { id: number; value?: T }"],
+  ["ts", "export class Box<T> extends Base implements Row<T> {\n  private items: Map<string, T[]> = new Map();\n}"],
+  ["ts", `async function run(x: number, y = \`n:\${x}\`): Promise<void> {
+  const re = /a+b/g; // note
+  for (const [k, v] of m) { if (v.length > 0 && k !== "") await f(k); }
+}`],
+  ["js", `const f = (a, b) => { /* c */ return a?.b ?? \`\${b}\`; };
+export default class A { static x = 1 }`],
+  ["json", '{ "a": [1, 2.5, true, null], "b": { "c": "d" } }'],
+  ["bash", '#!/bin/bash\nset -e\nfor f in *.md; do echo "$f" | grep -q x && cat "$f"; done'],
+  ["python", 'import os\n@dec\ndef f(x: int = 1) -> str:\n    """doc"""\n    return f"{x}" if x else None']
+];
+var HIGHLIGHT_CACHE_BYTES = 8 * 1024 * 1024;
+var highlightCache = new ByteLru(HIGHLIGHT_CACHE_BYTES);
+var highlighterPromise = null;
+var themeLoads = /* @__PURE__ */ new Map();
+function getHighlighter() {
+  if (!highlighterPromise) {
+    highlighterPromise = createHighlighter({
+      themes: INITIAL_THEMES,
+      langs: COMMON_LANGUAGES
+    }).catch((err) => {
+      highlighterPromise = null;
+      throw err;
+    });
+  }
+  return highlighterPromise;
+}
+async function ensureThemes(highlighter, palette) {
+  const { light, dark } = PALETTE_THEMES[palette];
+  const loaded = highlighter.getLoadedThemes();
+  const pending = [];
+  for (const theme of /* @__PURE__ */ new Set([light, dark])) {
+    if (loaded.includes(theme)) continue;
+    let load = themeLoads.get(theme);
+    if (!load) {
+      load = highlighter.loadTheme(theme).then(() => {
+        themeLoads.delete(theme);
+      }).catch((err) => {
+        themeLoads.delete(theme);
+        throw err;
+      });
+      themeLoads.set(theme, load);
+    }
+    pending.push(load);
+  }
+  await Promise.all(pending);
+}
+async function warmHighlighter() {
+  try {
+    const highlighter = await getHighlighter();
+    for (const [lang, snippet] of WARM_SNIPPETS) {
+      highlighter.codeToHtml(snippet, {
+        lang,
+        themes: PALETTE_THEMES[DEFAULT_PALETTE],
+        defaultColor: false
+      });
+      await new Promise((resolve) => setImmediate(resolve));
+    }
+  } catch {
+  }
+}
+function escapeHtml(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+async function highlightCode(code, lang, palette = DEFAULT_PALETTE) {
+  const key = `${palette}\0${lang}\0${createHash("sha256").update(code).digest("hex")}`;
+  const cached = highlightCache.get(key);
+  if (cached !== void 0) return cached;
+  const highlighter = await getHighlighter();
+  const loaded = highlighter.getLoadedLanguages();
+  let effectiveLang = lang;
+  if (lang && !loaded.includes(lang) && !["text", "plain", ""].includes(lang)) {
+    try {
+      await highlighter.loadLanguage(lang);
+    } catch {
+      effectiveLang = "text";
+    }
+  }
+  try {
+    await ensureThemes(highlighter, palette);
+    const html = highlighter.codeToHtml(code, {
+      lang: effectiveLang || "text",
+      themes: PALETTE_THEMES[palette],
+      defaultColor: false
+    });
+    highlightCache.set(key, html);
+    return html;
+  } catch {
+    return `<pre class="shiki shiki-fallback"><code>${escapeHtml(code)}</code></pre>`;
+  }
+}
+
+export {
+  highlightCache,
+  warmHighlighter,
+  highlightCode
+};
+//# sourceMappingURL=chunk-RBYD2HWV.mjs.map

package/bin/chunk-WWM6JNAS.mjs

@@ -0,0 +1,209 @@
+#!/usr/bin/env node
+import {
+  PALETTES
+} from "./chunk-XFRQFZZ4.mjs";
+
+// src/server/config.ts
+import { readFile } from "fs/promises";
+import os from "os";
+import path from "path";
+var CONFIG_FILENAME = ".mdview.json";
+var GLOBAL_CONFIG_FILENAME = "config.json";
+var FONT_FAMILIES = ["serif", "sans", "mono"];
+var IGNORE_ENTRY_PATTERN = /^[A-Za-z0-9_.\-+]{1,64}$/;
+function isObject(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function globalConfigPath() {
+  const xdg = process.env.XDG_CONFIG_HOME;
+  const base = xdg && xdg.length > 0 ? xdg : path.join(os.homedir(), ".config");
+  return path.join(base, "mdview", GLOBAL_CONFIG_FILENAME);
+}
+function validateConfig(raw, source = CONFIG_FILENAME, scope = "project") {
+  if (!isObject(raw)) return null;
+  const out = {};
+  if ("palette" in raw) {
+    const p = raw.palette;
+    if (typeof p === "string" && PALETTES.includes(p)) {
+      out.palette = p;
+    } else {
+      console.warn(`[mdview] ${source}: ignoring invalid palette: ${String(p)}`);
+    }
+  }
+  if ("fontFamily" in raw) {
+    const f = raw.fontFamily;
+    if (typeof f === "string" && FONT_FAMILIES.includes(f)) {
+      out.fontFamily = f;
+    } else {
+      console.warn(`[mdview] ${source}: ignoring invalid fontFamily: ${String(f)}`);
+    }
+  }
+  if ("lineWidth" in raw) {
+    const w = raw.lineWidth;
+    if (typeof w === "string" && w.length > 0 && w.length <= 32 && /^[\w%.-]+$/.test(w)) {
+      out.lineWidth = w;
+    } else {
+      console.warn(`[mdview] ${source}: ignoring invalid lineWidth: ${String(w)}`);
+    }
+  }
+  if ("defaultCollapsed" in raw && isObject(raw.defaultCollapsed)) {
+    const dc = raw.defaultCollapsed;
+    const collapsed = {};
+    if (typeof dc.tree === "boolean") collapsed.tree = dc.tree;
+    if (typeof dc.outline === "boolean") collapsed.outline = dc.outline;
+    if (collapsed.tree !== void 0 || collapsed.outline !== void 0) {
+      out.defaultCollapsed = collapsed;
+    }
+  }
+  if ("ignore" in raw) {
+    const ig = raw.ignore;
+    if (Array.isArray(ig)) {
+      const cleaned = [];
+      for (const entry of ig) {
+        if (typeof entry === "string" && entry !== "." && entry !== ".." && IGNORE_ENTRY_PATTERN.test(entry)) {
+          cleaned.push(entry);
+        } else {
+          console.warn(`[mdview] ${source}: ignoring invalid ignore entry: ${String(entry)}`);
+        }
+      }
+      if (cleaned.length > 0) out.ignore = cleaned;
+    } else {
+      console.warn(`[mdview] ${source}: ignoring invalid ignore (expected array of strings)`);
+    }
+  }
+  if ("updateCheck" in raw) {
+    if (scope !== "global") {
+      console.warn(`[mdview] ${source}: updateCheck is only read from the global config; ignoring`);
+    } else if (typeof raw.updateCheck === "boolean") {
+      out.updateCheck = raw.updateCheck;
+    } else {
+      console.warn(`[mdview] ${source}: ignoring invalid updateCheck: ${String(raw.updateCheck)}`);
+    }
+  }
+  return out;
+}
+async function loadConfigFromPath(filePath, source, scope) {
+  let raw;
+  try {
+    raw = await readFile(filePath, "utf8");
+  } catch (err) {
+    if (err.code === "ENOENT") return null;
+    console.warn(`[mdview] failed to read ${source}: ${err.message}`);
+    return null;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    console.warn(`[mdview] ${source} is not valid JSON: ${err.message}`);
+    return null;
+  }
+  return validateConfig(parsed, source, scope);
+}
+async function loadProjectConfig(rootAbsPath) {
+  return loadConfigFromPath(path.join(rootAbsPath, CONFIG_FILENAME), CONFIG_FILENAME, "project");
+}
+async function loadGlobalConfig() {
+  return loadConfigFromPath(
+    globalConfigPath(),
+    `~/.config/mdview/${GLOBAL_CONFIG_FILENAME}`,
+    "global"
+  );
+}
+function mergeConfigs(global, project) {
+  if (!global && !project) return null;
+  const out = {};
+  if (global?.palette !== void 0) out.palette = global.palette;
+  if (project?.palette !== void 0) out.palette = project.palette;
+  if (global?.fontFamily !== void 0) out.fontFamily = global.fontFamily;
+  if (project?.fontFamily !== void 0) out.fontFamily = project.fontFamily;
+  if (global?.lineWidth !== void 0) out.lineWidth = global.lineWidth;
+  if (project?.lineWidth !== void 0) out.lineWidth = project.lineWidth;
+  if (global?.defaultCollapsed || project?.defaultCollapsed) {
+    out.defaultCollapsed = { ...global?.defaultCollapsed, ...project?.defaultCollapsed };
+  }
+  const ig = [...global?.ignore ?? [], ...project?.ignore ?? []];
+  if (ig.length > 0) {
+    out.ignore = Array.from(new Set(ig));
+  }
+  return out;
+}
+async function loadEffectiveConfig(rootAbsPath) {
+  const [global, project] = await Promise.all([
+    loadGlobalConfig(),
+    loadProjectConfig(rootAbsPath)
+  ]);
+  return mergeConfigs(global, project);
+}
+
+// src/server/workspace.ts
+import path2 from "path";
+var ROOT_ID_PATTERN = /^[a-z0-9][a-z0-9._-]{0,63}$/;
+function isValidRootId(id) {
+  return id !== "." && id !== ".." && ROOT_ID_PATTERN.test(id);
+}
+function deriveRootId(absPath, taken) {
+  const slug = path2.basename(absPath).toLowerCase().replace(/[^a-z0-9._-]+/g, "-").replace(/^[^a-z0-9]+/, "").replace(/[-.]+$/, "").slice(0, 64);
+  const stem = isValidRootId(slug) ? slug : "root";
+  if (!taken.has(stem)) return stem;
+  for (let n = 2; ; n++) {
+    const candidate = `${stem.slice(0, 60)}-${n}`;
+    if (!taken.has(candidate)) return candidate;
+  }
+}
+function resolveRootId(spec, taken) {
+  if (spec.id && isValidRootId(spec.id) && !taken.has(spec.id)) return spec.id;
+  return deriveRootId(spec.absPath, taken);
+}
+function describeRoot(spec, id) {
+  return {
+    id,
+    name: spec.name ?? path2.basename(spec.absPath),
+    kind: spec.kind,
+    filePath: spec.kind === "file" ? spec.filePath ?? "" : ""
+  };
+}
+function parseWorkspacePath(roots, wsPath) {
+  const primary = roots[0];
+  if (!primary) return null;
+  const trimmed = wsPath.replace(/^\/+/, "");
+  const slash = trimmed.indexOf("/");
+  const head = slash === -1 ? trimmed : trimmed.slice(0, slash);
+  const match = roots.find((r) => r.root.id === head);
+  if (!match) return { state: primary, rel: trimmed };
+  return { state: match, rel: slash === -1 ? "" : trimmed.slice(slash + 1) };
+}
+function toWorkspacePath(rootId, rel) {
+  return rel ? `${rootId}/${rel}` : rootId;
+}
+
+// src/shared/ignore.ts
+var DEFAULT_IGNORED_DIRS = [
+  "node_modules",
+  "dist",
+  "build",
+  "out",
+  "target",
+  "coverage",
+  "vendor",
+  "__pycache__",
+  "venv",
+  "Pods",
+  "DerivedData",
+  "_build"
+];
+
+export {
+  CONFIG_FILENAME,
+  globalConfigPath,
+  loadGlobalConfig,
+  loadEffectiveConfig,
+  DEFAULT_IGNORED_DIRS,
+  isValidRootId,
+  deriveRootId,
+  resolveRootId,
+  describeRoot,
+  parseWorkspacePath,
+  toWorkspacePath
+};
+//# sourceMappingURL=chunk-WWM6JNAS.mjs.map

package/bin/chunk-XFRQFZZ4.mjs

@@ -0,0 +1,20 @@
+#!/usr/bin/env node
+
+// src/shared/types.ts
+var DEFAULT_PALETTE = "flexoki";
+var PALETTES = [
+  "flexoki",
+  "paper",
+  "solarized",
+  "everforest",
+  "rose-pine",
+  "kanagawa",
+  "catppuccin",
+  "high-contrast"
+];
+
+export {
+  DEFAULT_PALETTE,
+  PALETTES
+};
+//# sourceMappingURL=chunk-XFRQFZZ4.mjs.map